feat: config-core + openlock validate (bd openlock-lvc.2)#54
Merged
Conversation
Route the runtime config-read path through parseManifest from config-core, deleting the duplicate parseMounts/parseArgs/parseEnv validators from mounts.ts and openlock-folder.ts. Stale caps keys now throw instead of emitting a deprecation warning.
vessux
added a commit
that referenced
this pull request
May 30, 2026
…p race (bd openlock-eh8) (#55) post-create-exec-proxy.test.ts was the one echo-mode integration test still on bare `curl -sf`, missing the `--retry 5 --retry-all-errors` hardening its siblings (harness-cred-inject, openrouter-opencode-cred-inject) received in #38. That gap is why it became the recurring exit-56 flake locus on #52/#53/#54. exit 56 = curl CURLE_RECV_ERROR from the in-container echo proxy on first egress, relayed faithfully through ssh (ssh's own transport failures are 255, never 56) — NOT an ssh transport drop as previously suspected. `curl -s` was muting curl's error, which presented as "empty stdout/stderr". - add `--retry 5 --retry-all-errors --retry-delay 1` to the post-create exec test - switch all three flaking tests `-sf` -> `-sSf` so a retries-exhausted failure surfaces curl's real error instead of being silently muted bd openlock-eh8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Builds
src/config-core/— one deep module that validates the whole.openlock/folder (manifest + policy) behind a narrow interface — and ships it asopenlock validate, the early-validation gate of the onboarding golden path (epicopenlock-lvc, child lvc.2).config-coredefines the manifest schema/semantic/filesystem rules once and exposes two entry points:lintManifest/lintFolder(collect-all, forvalidate) andparseManifest(strict/throw, for the live sandbox path).src/sandbox/openlock-folder.ts+mounts.tsare re-pointed atparseManifest, so the linter and the runtime can no longer drift.mounts.tsshed ~185→72 lines (validation moved out; only staging helpers remain).openlock validate [path]— zero-arg discovery of.openlock/, lintsconfig.yaml+policy.yamltogether, grouped/tiered output withfix:lines and a per-file summary,--offlineto skip filesystem-existence checks (for CI / fresh clones), exit 1 on any error/filesystem issue.error/filesystem); unknown manifest keys are now hard errors (consistent withglobal-config).src/validate-policy/→src/config-core/policy/(rules unchanged); the standalonevalidate-policycommand is removed.Built TDD via subagent-driven development; each task spec- and quality-reviewed. Spec + plan:
docs/superpowers/specs/2026-05-30-config-core-validate-design.md,docs/superpowers/plans/2026-05-30-config-core-validate.md(local-only, gitignored).openlock validate-policyremoved. Its function is nowopenlock validate, which lints the manifest too.caps:in.openlock/config.yamlis now a hard error (unknown key "caps") instead of an ignored-with-warning field — and it now blocksopenlock sandbox, not justvalidate. Stale configs must delete it.Test plan
bun run lint && bun run typecheck && bun test && bun run knip— all green (650 pass / 8 skip / 0 fail).openlock validatesmoke: missing.openlock/(→ init hint, exit 1), valid (exit 0), broken config+policy (grouped, exit 1), missing mount source (exit 1[fs];--offline→ exit 0).openlock gateway stop && start, launch a sandbox with a real.openlock/config.yamlcarrying mounts/args/env) — confirms the re-pointed runtime stages mounts + applies args/env identically, and that a stalecaps:now errors at launch. (Change is parse-layer-only with fullMount[]parity proven by the ported tests, so low-risk, but it's the one contract that only surfaces at runtime.)Notes
credentialsPath()now honorsXDG_CONFIG_HOME— n/a here, tracked from the prior lvc.3 PR.